Falhas do tipo CWE-184

197 resultados

Lista incompleta de entradas bloqueadas

Quando um aplicativo tenta bloquear entradas perigosas (como caracteres especiais, palavras-chave ou padrões maliciosos), mas a lista de bloqueio é incompleta ou mal pensada, um atacante consegue contornar a proteção usando variações não previstas. É a falsa sensação de segurança: o desenvolvedor acredita estar protegido, mas deixa brechas.

Exemplo

Um formulário web bloqueia a palavra 'script' para evitar XSS, mas não bloqueia 'sCrIpT' com letras maiúsculas, ou '\x3cscript' em hexadecimal. Um atacante injeta uma dessas variações e consegue executar JavaScript malicioso, burlando a proteção.

Como mitigar

Em vez de manter listas de bloqueio (blacklist), use whitelist: aceite apenas entradas conhecidas como seguras, validate com regex rigorosa e, quando possível, escape ou sanitize output com bibliotecas consolidadas (DOMPurify, OWASP, etc). Prefira validação estruturada sobre verificações ad-hoc.

CVE-2025-58353HIGHPromptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping PatternsEPSS 0.2%CVE-2026-49825HIGHlxml: javascript: URL bypass in Cleaner via xlink:hrefEPSS 0.2%CVE-2026-44287MEDIUMFastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassableEPSS 0.2%CVE-2022-50238HIGHThe on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. SoEPSS 0.2%CVE-2025-1484MEDIUMA vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker couldEPSS 0.2%CVE-2026-44463HIGHZed: Allowlist Bypass via Environment Variable Injection in Terminal Tool PermissionsEPSS 0.2%CVE-2026-33628MEDIUMInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line ItemsEPSS 0.2%CVE-2026-26274MEDIUMOctober: Safe Mode Bypass via Twig Database Write OperationsEPSS 0.2%CVE-2026-55830HIGHRestrictedPython guard hooks can be shadowed via positional-only argumentsEPSS 0.2%CVE-2026-43929HIGHssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed InputsEPSS 0.2%CVE-2025-46417MEDIUMThe unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS afteEPSS 0.2%CVE-2026-44587MEDIUMCarrierWave has a denylisted_content_type bypass via Unescaped Regex MetacharactersEPSS 0.2%CVE-2026-68921MEDIUMDiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)EPSS 0.2%CVE-2026-40077LOWBeszel has an IDOR in hub API endpoints that read system ID from URL parameterEPSS 0.2%CVE-2026-72779HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectEPSS 0.2%CVE-2026-41361MEDIUMOpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use RangesEPSS 0.2%CVE-2026-57234LOWNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247EPSS 0.2%CVE-2026-18356LOWLimit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account EmailEPSS 0.2%CVE-2026-85787HIGHAn incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverEPSS 0.2%CVE-2026-18174MEDIUM@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-ForEPSS 0.2%